Package evidence

@ublend-npm/[email protected]

Remote Payload: matched "github.com/serverless/serverless/releases/download"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 3
First published: Apr 2020
Publisher: amuslija

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@ublend-npm/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@ublend-npm/[email protected]"],"fail_on":"review"}'

Publisheramuslija

Artifact bytes888,988

Previous versionnone

Published2020-04-28T11:05:17.467Z

SHA-256a71554721ee9cbdfbcae931cde2ab6ecd815cc555c3e95b9d129017417611627

Why flagged

What the scanner saw

Remote Payload: matched "github.com/serverless/serverless/releases/download"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

2d agoLast checked

reviewRisk

69Score

1.68.1Version

Status history (1 event)

new → available2d ago · risk review · score 69 · status changed

Evidence

Static findings

12 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/lib/plugins/executable/index.js	matched "github.com/serverless/serverless/releases/download"	12
medium	Remote Payload	package/lib/plugins/plugin/lib/utils.js	matched "raw.githubusercontent.com"	12

Show all 12 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/lib/plugins/executable/index.js	matched "github.com/serverless/serverless/releases/download"	12
medium	Remote Payload	package/lib/plugins/plugin/lib/utils.js	matched "raw.githubusercontent.com"	12
low	Credential file access	package/lib/plugins/aws/configCredentials/awsConfigCredentials.js	matched ".aws/"	5
low	Credential file access	package/lib/plugins/aws/configCredentials/awsConfigCredentials.test.js	matched "aws_access_key"	5
low	Credential file access	package/lib/plugins/aws/provider/awsProvider.test.js	matched "aws_access_key"	5
low	Credential file access	package/lib/plugins/aws/utils/credentials.js	matched "aws_access_key"	5
low	Credential file access	package/lib/plugins/aws/utils/credentials.test.js	matched "aws_access_key"	5
low	Credential file access	package/lib/plugins/aws/invokeLocal/index.test.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/lib/plugins/interactiveCli/setupAws.js	matched ".aws\\"	5
low	Credential file access	package/lib/plugins/interactiveCli/setupAws.test.js	matched "aws_access_key"	5
low	Install-time lifecycle script	package.json	postinstall="node ./scripts/postinstall.js"	5
low	Obfuscation Density	package/lib/plugins/create/templates/twilio-nodejs/package-lock.json	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts22

commitlintcommitlint -f HEAD@{15}
commitlint:pull-requestcommitlint -f HEAD~1
coveragenyc npm test
integration-test-cleanupnode tests/utils/aws-cleanup.js
integration-test-run-allmocha-isolated --pass-through-aws-creds --skip-fs-cleanup-check --max-workers=20 tests/integration-all/**/tests.js
integration-test-run-basicmocha tests/integration-basic/tests.js
integration-test-run-packagemocha-isolated --skip-fs-cleanup-check tests/integration-package/**/*.tests.js
linteslint . --cache
lint:fixnpm run lint -- --fix
lint:updatedpipe-git-updated --ext=js -- eslint --cache
pkg:buildnode ./scripts/pkg/build.js
pkg:generate-choco-packagenode ./scripts/pkg/generate-choco-package.js
pkg:uploadnode ./scripts/pkg/upload.js
postinstallnode ./scripts/postinstall.js
prepare-releasestandard-version && prettier --write CHANGELOG.md
prettier-checkprettier -c --ignore-path .gitignore "**/*.{css,html,js,json,md,yaml,yml}"
prettier-check:updatedpipe-git-updated --ext=css --ext=html --ext=js --ext=json --ext=md --ext=yaml --ext=yml -- prettier -c
prettifyprettier --write --ignore-path .gitignore "**/*.{css,html,js,json,md,yaml,yml}"
prettify:updatedpipe-git-updated --ext=css --ext=html --ext=js --ext=json --ext=md --ext=yaml --ext=yml -- prettier --write
testmocha "!(node_modules)/**/*.test.js"
test:cinpm run prettier-check:updated && npm run lint:updated && npm run test:isolated
test:isolatedmocha-isolated

Dependencies53

@serverless/cli^1.4.0
@serverless/components^2.29.2
@serverless/enterprise-plugin^3.6.6
archiver^1.3.0
async^1.5.2
aws-sdk^2.660.0
bluebird^3.7.2
boxen^3.2.0
cachedir^2.3.0
chalk^2.4.2
child-process-ext^2.1.1
ci-info^1.6.0
d^1.0.1
dayjs^1.8.25
decompress^4.2.1
download^7.1.0
essentials^1.1.1
fast-levenshtein^2.0.6
filesize^3.6.1
fs-extra^0.30.0
get-stdin^5.0.1
globby^6.1.0
graceful-fs^4.2.3
https-proxy-agent^4.0.0
inquirer^6.5.2
is-docker^1.1.0
is-wsl^2.1.1
js-yaml^3.13.1
json-cycle^1.3.0
json-refs^2.1.7
…and 23 more.